symphonycms/symphony-2 — pull request #1666 by nils-werner (2013-02-21 17:27:51+00:00)
Title: Password cleanvalue consistency

This PR tries to fix the inconstent treatment of passwords. Before this PR the situation was as follows:

- Passwords were being `cleanValue`d during installation [[1]](https://github.com/symphonycms/symphony-2/blob/master/install/lib/class.installer.php#L438)
- Passwords were **double** `cleanValue`d during login [[1]](https://github.com/symphonycms/symphony-2/blob/master/symphony/content/content.login.php#L153) [[2]](https://github.com/symphonycms/symphony-2/blob/master/symphony/lib/core/class.symphony.php#L358)
- Passwords were **not** `cleanValue`d during author editing [[1]](https://github.com/symphonycms/symphony-2/blob/master/symphony/content/content.systemauthors.php#L478) [[2]](https://github.com/symphonycms/symphony-2/blob/master/symphony/content/content.systemauthors.php#L559)

This means that in case a user was using any characters being affected by `Database::cleanValue` he would have locked himself out of the backend.

This PR fixes that:

- Passwords are always `cleanValued` before being hashed. There is no point in doing it really as the hash function will remove the threat that comes from unsanitized strings in queries. It's just to give all variables touching the DB the same treatment.
- `Symphony::login()` should not assume the strings to be sanitized so the cleanValuing should go in there.